fac62ca4a732451f6cda25e29be0d6ceda7e2411e18a8183a879008fb9ebc571

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 01:43

Target
23341b3cf3241e13cdd4d9036af1972b.exe
Size 1.9MB
Sample231231-b5f7ragagk
SHA256 fac62ca4a732451f6cda25e29be0d6ceda7e2411e18a8183a879008fb9ebc571
MD5 23341b3cf3241e13cdd4d9036af1972b
SHA1 d55d43b44b4d132970a757f102ed223a28d1e8a7
SHA512 81ab996c62136e462f370a7cf6af6bf53d18f96807a42c412f72e279e5f798b9c5677bd0a3104ffb7403816adda51f84c91148fa5f2fef7c2de069942255dbaf
SSDEEP 49152:Qoa1taC070d3ADVy3xbwsACyhMFvyE1UbLBgOv2m:Qoa1taC0hDVstACZyVBrv2m
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Deletes itself 1 IoCs

pid	Process
4876	5B3F.tmp

Executes dropped EXE 1 IoCs

pid	Process
4876	5B3F.tmp

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4876	5108	23341b3cf3241e13cdd4d9036af1972b.exe	36
PID 5108 wrote to memory of 4876	5108	23341b3cf3241e13cdd4d9036af1972b.exe	36
PID 5108 wrote to memory of 4876	5108	23341b3cf3241e13cdd4d9036af1972b.exe	36

C:\Users\Admin\AppData\Local\Temp\23341b3cf3241e13cdd4d9036af1972b.exe
"C:\Users\Admin\AppData\Local\Temp\23341b3cf3241e13cdd4d9036af1972b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Users\Admin\AppData\Local\Temp\5B3F.tmp
  "C:\Users\Admin\AppData\Local\Temp\5B3F.tmp" --splashC:\Users\Admin\AppData\Local\Temp\23341b3cf3241e13cdd4d9036af1972b.exe 2E54E2530B3506902DD1BEC73FA1575C0A19EB21BD54777CCD8EBF0D9F44E2A90EE28E8E9DFCBB6975C144D198F685712FF8F376CE16D724DE2930EDB398459C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:4876

memory/4876-5-0x0000000000400000-0x00000000005E6000-memory.dmp

Download

memory/5108-0-0x0000000000400000-0x00000000005E6000-memory.dmp

Download